netwire | 0fda1a21ab1ba27664e58228ab32452ed711d4ae1713deadbe20aac8cf193041

General

Target

SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
Size

939KB
MD5

eddc29896f0f6dc74fb9746d22be40cb
SHA1

9a94123aaa7c0aa998d2eb09a74e20cf9f1d9715
SHA256

0fda1a21ab1ba27664e58228ab32452ed711d4ae1713deadbe20aac8cf193041
SHA512

c2ae7e4d58e0c0ffc58a5c8e2fa3322e217fa67d831301e2aaf88ae62b07677abc2c9ea3df22578114852c107c39d06f255e65014b4b414b57405d8036b856a2

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

sipex2021.ddns.net:8753

Attributes

activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
Password
registry_autorun
false
startup_name
use_mutex
false

Signatures

NetWire RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1184-66-0x0000000000400000-0x0000000000433000-memory.dmp	netwire
behavioral1/memory/1184-67-0x000000000040242D-mapping.dmp	netwire
behavioral1/memory/1184-69-0x0000000000400000-0x0000000000433000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe

description	pid	process	target process
PID 1100 set thread context of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe

description	pid	process	target process
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
PID 1100 wrote to memory of 1184	1100	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe	SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Win32.Wacapew.Cml.7225.2383.exe"
2⤵
PID:1184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1100-60-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/1100-62-0x0000000004D50000-0x0000000004D51000-memory.dmp

Filesize
4KB

Download
memory/1100-63-0x0000000000990000-0x00000000009A4000-memory.dmp

Filesize
80KB

Download
memory/1100-64-0x0000000005000000-0x000000000509A000-memory.dmp

Filesize
616KB

Download
memory/1100-65-0x00000000050A0000-0x00000000050FA000-memory.dmp

Filesize
360KB

Download
memory/1184-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1184-67-0x000000000040242D-mapping.dmp

Download
memory/1184-68-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/1184-69-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads